A Denial of Service (DoS) attack is a malicious attack that causes great harm to a network, in which a host usually attacks a target. A Distributed Denial of Service (DDoS) attack is an attack in which many hosts in a network are controlled to collectively attack a server.
Typical forms of the DoS attack include Packet Internet Grope, ping of death, a teardrop attack, a User Datagram Protocol (UDP) flooding attack, a synchronization (SYN) attack, a land attack, and an Internet Protocol (IP) counterfeiting DoS.
A typical form of the DDoS attack using the Transfer Control Protocol (TCP) is as follows.
The TCP is a connection-oriented protocol, and two communication parties in the network are required to establish a connection before using the protocol for communication. The establishment of the connection includes three steps.
In step 1, when the connection is being established, a client sends an SYN packet indicating a port of a server to which the client is to be connected and an initial sequence number x.
In step 2, a server returns an SYN packet including an initial sequence number y of the server as a response, and at the same time sets an acknowledgment sequence number ACK as (x+1) to acknowledge the SYN packet of the client. An SYN occupies a sequence number.
In step 3, the client acknowledges the SYN packet of the server by setting the acknowledgment sequence number ACK as (y+1). The three packets complete the establishment of the TCP connection.
The process is also called a “3-step handshake” process.
The DoS attack is an attack aiming at the “3-step handshake” process of the TCP connection. After the server end sends the connection response packet in step 2, the client maliciously does not send the third acknowledgement packet, so the server end keeps waiting for the third acknowledgment message, and sends the second response packet to the client repeatedly, thus occupying a lot of server resources and eventually resulting in that the server cannot provide normal services for other clients.
In the conventional art, a method for preventing the DDoS attack is as follows.
In the method, a router is appropriately configured to prevent the DDoS attack, and the method includes: using an extended access list, unicast reverse path forwarding, TCP intercepting, and content-based access control.
A content-based access control technology is a method for preventing the DoS attack, where TCP and UDP data packets are filtered intelligently according to application layer session information. The method determines duration of a session and when to delete a semi-connection by setting a timeout threshold value and a session threshold value. The method prevents the flooding attack just by monitoring the number of semi-connections and a frequency of the semi-connections. Whenever an abnormal semi-connection is established, or a large number of semi-connections emerge in a short period of time, a user can judge that the flooding attack occurs.
The content-based access periodically (for example, every minute) detects the number of existing semi-connections and a frequency of attempts to establish a connection. When the number of the existing semi-connections exceeds a threshold value, a router deletes some semi-connections to meet demands of establishing new connections, and the router continuously deletes the semi-connections until the number of the existing semi-connections is smaller than another threshold value. Similarly, when the frequency of the attempts to establish a connection exceeds a threshold value, the router takes the same measures to delete a part of connection requests until the number of the connection requests is smaller than another threshold value. By continuously monitoring and deleting, the SYN flooding attack can be effectively prevented. However, the method of setting the threshold values of the semi-connections has certain errors, and cannot precisely judge the semi-connections in the connection of the DDos attack from possible semi-connections during a normal connection.